975ebd15c72754378f2a55d809a321666db1b68a69e6fbfb6ae19813f7809ca9

Analysis

max time kernel
140s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15-05-2023 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9668d025a5199637764d3d61bb9220e7.exe
Size

576KB
MD5

9668d025a5199637764d3d61bb9220e7
SHA1

9e4752217f9b2c6c2301af179b25b5403d8b31be
SHA256

975ebd15c72754378f2a55d809a321666db1b68a69e6fbfb6ae19813f7809ca9
SHA512

1fffa0797f07bab919f9735286cc6ca93af1a95ffd2400c5567717e300632dad5aab2dfb086e5f44dda5242afa9c52617a339fb1302b735407f521d04c348d59
SSDEEP

12288:5wSPdgdxjf+ct1Uwi193YIKrapYV7aE8p3iIF/hqL9bcZOaoY:5wigdxjpFi193YIKGc7z8hqCgY

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	9668d025a5199637764d3d61bb9220e7.exe

C:\Users\Admin\AppData\Local\Temp\9668d025a5199637764d3d61bb9220e7.exe
"C:\Users\Admin\AppData\Local\Temp\9668d025a5199637764d3d61bb9220e7.exe"
1⤵
- Writes to the Master Boot Record (MBR)
PID:624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/624-55-0x0000000000400000-0x000000000070D000-memory.dmp

Filesize
3.1MB

Download
memory/624-56-0x0000000000220000-0x000000000028B000-memory.dmp

Filesize
428KB

Download
memory/624-57-0x0000000000400000-0x000000000070D000-memory.dmp

Filesize
3.1MB

Download